Gemstone-Source

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.4 **Description** Authenticated users with `api.webhooks.write` permission can create webhooks using unrestricted cURL protocols such as `file://`, `dict://`, or `gopher://`. This allows attackers to trigger webhook events to read local files, access process information, or pivot to internal services. **Recommendations** Update to version 2.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.4 **Description** A regular expression denial of service (ReDoS) exists in the `regex replace` filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled via the `security.twig content.process enabled` variable, an authenticated page editor can provide a catastrophically backtracking PCRE pattern. This pattern is passed to the PHP `preg replace()` function, leading to unbounded CPU consumption and a denial of service for the web server process. **Recommendations** Update Grav to version 2.0.4 or later. Disable Twig processing in page content by setting `security.twig content.process enabled` to false.

**Name of the Vulnerable Software and Affected Versions** grav-plugin-api versions prior to 1.0.4 **Description** An unauthenticated attacker can cause a password reset email to contain a link pointing to a server under their control. This occurs because the `sanitizeHttpUrl()` function fails to verify the host against the server's own origin, checking only that the URL scheme is http or https. The issue exists in the 'POST /api/v1/auth/forgot-password' endpoint via the `admin base url` field, and can also be influenced by the `Referer` or `Origin` headers. If a victim follows the malicious link, the valid reset token is disclosed to the attacker, allowing for full account takeover. **Recommendations** Update to version 1.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Grav version 2.0.0 **Description** An issue exists where the XSS blueprint validator `Security::detectXss()` processes raw page content before Twig processing occurs. If Twig content processing is enabled via `twig content.process enabled: true`, a user with page-write API permissions can bypass the validator using Twig's string concatenation operator (~) to dynamically create event handlers, dangerous tags, or protocols. Because the validator only sees the Twig expression and not the final rendered output, arbitrary JavaScript can be executed in the browsers of visitors when the content is rendered via `{{ page.content|raw }}`. **Recommendations** Update Grav to version 2.0.1. Disable the `twig content.process enabled` setting to prevent Twig content processing.